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Abstract 

This paper studies the throughput of large-scale decentralized wireless networks with physical layer 
security constraints. In particular, we are interested in the question of how much throughput needs to be 
sacrificed for achieving a certain level of security. We consider random networks where the legitimate nodes 
and the eavesdroppers are distributed according to independent two-dimensional Poisson point processes. The 
transmission capacity framework is used to characterize the area spectral efficiency of secure transmissions 
with constraints on both the quality of service (QoS) and the level of security. This framework illustrates the 
dependence of the network throughput on key system parameters, such as the densities of legitimate nodes 
and eavesdroppers, as well as the QoS and security constraints. One important finding is that the throughput 
cost of achieving a moderate level of security is quite low, while throughput must be significantly sacrificed 
to realize a highly secure network. We also study the use of a secrecy guard zone, which is shown to give 
a significant improvement on the throughput of networks with high security requirements. 

Index Terms 

Physical layer security, decentralized wireless networks, transmission capacity, guard zone. 

I. Introduction 

The problem of securing wireless communications at the physical layer has recently drawn 
considerable attention. In the pioneering works on physical layer security, Wyner [1] introduced 
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the wiretap channel for single point-to-point communication, which was extended to broadcast 
channels with both common and confidential messages by Csiszar and Korner [2]. Their results 
showed that perfect secrecy can be achieved if the intended receiver has a stronger channel than 
the eavesdropper. Recent studies on physical layer security primarily focused on communications 
involving a small number of nodes with multi-antenna transmission [3-5], cooperative transmission 
in relay channels [6, 7] or multiple access channels [8, 9]. However, few studies have been carried out 
for large-scale wireless networks. Unlike point-to-point communications, where it is reasonably easy 
to establish secret keys and have encrypted transmissions, security is more expensive and difficult to 
achieve in large-scale decentralized networks. Therefore, physical layer security may be important 
for exchanging secret keys and adding another layer of protection in such networks. 

The communication between any pair of nodes in large-scale networks strongly depends on the 
locations of other nodes and how the nodes interact with each other. When secure communication 
is required in the presence of eavesdroppers, the locations and channel state information of the 
eavesdroppers, which are usually unknown, become extra parameters affecting the network through- 
put. Initial works on network security from an information-theoretic viewpoint mainly considered 
networks where the legitimate nodes and the eavesdroppers are randomly distributed, and studied 
the connectivity [10-14], coverage [15], and capacity scaling laws [16-18]. Specifically, various 
statistical characterizations of the existence of secure connections were given in [10-12, 14]. Using 
tools from percolation theory, the existence of a secrecy graph was analyzed in [10, 12, 13]. These 
connectivity results are concerned with the possibility of having secure communication, while they do 
not give insight on the network throughput. The authors in [16-18] derived secrecy capacity scaling 
laws in static and mobile ad hoc networks, i.e., the order-of-growth of the secrecy capacity as the 
number of nodes increases. Although the scaling laws may provide insights into the information- 
theoretic performance of large-scale networks, a finer view of throughput is necessary to better 
understand the impact of key system parameters and transmission protocols, since most of these 
design choices affect the throughput but not the scaling behaviors [19]. 

A. Approach and Contributions 

In this work, we aim to characterize the throughput of secure communications in large wireless 
networks and to understand how the security requirements affect the network throughput. Our 
approach uses a metric termed the transmission capacity [20], which provides the area spectral 
efficiency (ASE) of decentralized networks with random topology, identical nodes, and a constraint 
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on outage probability. A tutorial on transmission capacity can be found in [21], which showed how 
analytical results can often be derived in simple forms. We extend this capacity framework to study 
the impact of physical layer security requirements on the network ASE. 

The networks considered have both legitimate nodes and eavesdroppers, whose locations follow 
homogeneous Poisson point processes (PPPs). We define the secrecy transmission capacity as the 
achievable rate of successful transmission of confidential messages per unit area for given constraints 
on the quality of service (QoS) and the level of security. The QoS constraint is given by the outage 
probability of the transmission between a legitimate transmitter-receiver pair, while the security 
constraint is given by the probability of a transmission failing to achieve perfect secrecy. The secrecy 
transmission capacity shows the dependence of the network ASE on the key system parameters, 
i.e., the densities of legitimate nodes and eavesdroppers, as well as the QoS and security constraints. 

To illustrate the use of the general capacity formulation, we derive an accurate closed-form lower 
bound on the secrecy transmission capacity for Rayleigh fading channels. This simple capacity bound 
gives a quantitative characterization of the throughput cost of physical layer security. Specifically, 
the throughput reduction for achieving a moderate level of security is relatively small, while a 
significant amount of throughput needs to be sacrificed to realize a highly secure network. We also 
give a condition for the existence of positive secrecy transmission capacity. It turns out that the 
QoS and security constraints as well as the density of eavesdroppers are crucial in determining the 
existence of positive secrecy transmission capacity. 

In order to minimize the throughput cost of achieving high network security, it is worthwhile to 
consider transmission protocols that are robust against eavesdropping and can be implemented in a 
decentralized manner. Since insecure transmission is mainly due to the presence of an eavesdropper 
close to the transmitter, we consider the use of a secrecy guard zone for networks in which the 
legitimate transmitters are able to detect the existence of eavesdroppers in their vicinities [11, 16]. 1 
Transmission of confidential messages take place only if no eavesdroppers are found inside the guard 
zone of the corresponding transmitter. We consider two transmission protocols when eavesdropper(s) 
are found inside the guard zone, i.e., the transmitter either remains silent or produces artificial noise to 
help the other transmitters. The secrecy transmission capacity is studied for both protocols. Numerical 
results show that a significant throughput improvement can be achieved from the use of a guard 

'The application of secrecy guard zone is not always possible. It is applicable in the scenarios where, for example, the legitimate 
transmitters are able to physically inspect their surrounding areas [11]. 



4 



zone for networks with high security requirements. 

The rest of the paper is organized as follows: Section II presents the system model and the 
secrecy transmission capacity formulation. In Section III, we obtain analytical results on the secrecy 
transmission capacity in Rayleigh fading channels. In Section IV, we investigate the secrecy guard 
zone with two different transmission protocols. Numerical results are presented in Section V and 
concluding remarks in Section VI. A summary of the notation used in this paper is given in Table I. 

II. System Model And Capacity Formulation 

We consider an ad hoc network consisting of both legitimate nodes and eavesdroppers over a 
large two-dimensional space. For each snapshot in time, we have a set of legitimate transmitter 
locations, denoted by $^. 2 Each transmitter has a unique associated intended receiver. The set of 
receivers is disjoint with the set of transmitters. In addition, we have a set of eavesdropper locations 
in each snapshot, denoted by $ e . We model and $ e as independent homogeneous PPPs with 
densities A/ and A e , respectively. This is a suitable model for decentralized networks with nodes 
having substantial mobility [21]. Note that the eavesdroppers need to have similar mobility and other 
behaviors as the legitimate nodes since they can be easily identified otherwise [17]. Furthermore, 
we assume that the eavesdroppers do not collude with each other and, hence, must decode the 
confidential messages individually. An example of a network snapshot is shown in Fig. 1. 

Consider only one active transmitter that wants to send confidential messages to its intended 
receiver in the presence of the eavesdroppers. Secure encoding schemes, such as the Wyner code [1], 
were found in point-to-point systems with the notion of weak secrecy. The notion of strong secrecy 
and the corresponding encoding scheme were studied in [22]. According to Wyner' s encoding 
scheme, the transmitter chooses two rates, namely, the rate of the transmitted codewords R t and the 
rate of the confidential messages R s . The rate difference R e = R t — R s reflects the cost of securing 
the messages against eavesdropping. If R t is less than the mutual information between the channel 
input and output of the legitimate link, the receiver is able to decode the message with an arbitrarily 
small error. At the same time, if R e is larger than the mutual information between the channel 
input and output of every eavesdropper link (i.e., links from the transmitter to every eavesdropper), 
perfect secrecy is achieved as the mutual information between the confidential message and every 

2 For networks employing a slotted Aloha protocol, can be viewed as the locations of the actual transmitters (out of all potential 
transmitters) in each time slot. 
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eavesdropper's received signal approaches zero ratewise. The detailed description of the Wyner code 
can be found in [1,23,24]. 

In an ad hoc network with simultaneous transmissions from infinitely many legitimate transmitters, 
it is difficult to study the mutual information between any pair of nodes. To make the design and 
analysis mathematically tractable, we assume that the transmitted signal (i.e., channel input) has a 
Gaussian distribution and both the intended receivers and the eavesdroppers treat the interference 
from concurrent transmissions as noise. In addition, we assume that the network is interference- 
limited, hence, the receiver noise is negligible. With these assumptions, the mutual information or 
capacity of either a legitimate link or an eavesdropper link is now determined by the instantaneous 
signal to interference ratio (SIR). For any given choices of R t and R s in Wyner' s encoding scheme, 
the following outage events can result from any transmission [24]: 

• Connection Outage: The capacity of the channel from the transmitter to the intended receiver 
is below the transmission rate R t . Hence, the message cannot be correctly decoded by the 
intended receiver. The probability of this event happening is referred to as the connection 
outage probability, denoted as P co . 

• Secrecy Outage: The capacity of the channel from the transmitter to one or more eavesdroppers 
is above the rate R e . Hence, the message is not perfectly secure against eavesdropping. The 

probability of this event happening is referred to as the secrecy outage probability, denoted as 
p 

1 so- 

The connection outage probability can be regarded as the communication QoS while the secrecy 
outage probability gives a measure of the security level. 

The primary goal of this work is to characterize the throughput of secure transmissions in 
decentralized wireless networks. Although it is extremely difficult to find the network capacity region, 
the idea of transmission capacity proposed in [20] often gives useful insights on the network ASE and 
the impacts of the key system parameters. Building on the existing transmission capacity framework, 
we define the secrecy transmission capacity as the achievable rate of successful transmission of 
confidential messages per unit area, for a given connection outage constraint and a given secrecy 
outage constraint. Mathematically, the secrecy transmission capacity, with a connection outage 
probability of P co = a and a secrecy outage probability of P so = e, is defined as 

r = R s (l-a)X h (1) 

where R s is the average rate of confidential messages. In this work, we focus on a simple scenario 
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where the transmit power and the distances to the intended receivers have fixed values which are 
the same for all transmitters. Therefore, the confidential message rates also take the same values 
for all transmitters. Denote the distance between the legitimate transmitter-receiver pairs as r, the 
secrecy transmission capacity can be written as 



The connection outage constraint a determines the value of R t , while the secrecy outage constraint 
e determines the value of R e . Therefore, the rate of confidential messages R s in (2), given by 
R t — R e , is a function of a and e. With these choices of rates for the Wyner code, the probability 
that a message transmission can be successfully decoded by the intended receiver is 1 — a, while 
the probability that a message transmission is perfectly secure against eavesdropping is 1 — e, under 
the assumption of treating interference as noise. 

If we allow the distance between the legitimate transmitter-receiver pair varies over time and/or 
space but follows some known distribution f(r), the secrecy transmission capacity is computed as 



In practice, the distribution of r depends on specific scenarios. Hence, we do not consider the 
variation in r and focus on r(r) in (2). 

III. Secrecy Transmission Capacity in Rayleigh Fading Channels 

In this section, we derive analytical results on the secrecy transmission capacity for Rayleigh 
fading channels. We assume that each node has a single antenna for transmission or reception, and 
the fading channel states are known at the receiver side (including the eavesdroppers) but not at 
the transmitter side. The derivation of the secrecy transmission capacity involves two main steps: 1) 
Use the connection outage constraint a to find the value of R t . 2) Use the secrecy outage constraint 
e to find the value of R e . 

Our analysis is based on an arbitrarily chosen transmitter-receiver pair, which are named the 
typical transmitter and receiver. For confidential message transmission from the typical transmitter, 
the other transmitters act as interferers to the typical receiver or any eavesdropper. From Slivnyak's 
Theorem [25], the spatial distribution of the interferers, given the location of the typical transmitter, 
still follows a homogeneous PPP with density X t . By slight abuse of notation (since we have used 
<3>z to denote the set of all transmitter locations), we will also refer to as the set of interferer 
locations in the rest of this paper. 



r(r) = J R s (l-<7)A J . 



(2) 




(3) 
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For the typical receiver, a connection outage occurs if log 2 (l + SIR ) < Rt, where SIR denotes 
the SIR at the typical receiver given by 

S r~ a 



SIRn 



(4) 



where So and r are the channel fading gain and the distance between the typical transmitter and 
receiver, respectively, a is the path loss exponent, S t and \X t \ are the channel fading gain and the 
distance between the interferer (at position) / in and the typical receiver, respectively. We assume 
a > 2 throughout this paper. The fading gains are modeled as independent and identically distributed 
(i.i.d.) exponential random variables with unit mean. 
Define a threshold SIR value for connection outage as 



2 Rt _ L 



Hence, the connection outage probability can be written as 



P(SIR < A) =P 



S r~ 



< A 



(5) 



(6) 



Efe$, s i\ x i 

The summation term £ Jg $ ^1^1 a * s a snot n °i se process [26] in two-dimensional space whose 
Laplace transform is known in a closed form and was used to compute the connection outage 
probability in [27] as 

2 \ _ / 2 



1 — exp 



-W/?T(i-^)r(i + i) 



(7) 



With the connection outage constraint given by P co = a, the transmission rate R t can be found 
using (5) and (7) as 



Rt = log 2 1 + 



ln^- 

1 — (7 



(8) 



Vr(i4)r(i + I) 

It is clear that a lower connection outage probability (i.e., a higher QoS) requires a lower R t . 

On the other hand, the confidential message transmission is not perfectly secure against the 
eavesdropper (at position) e in $ e if log 2 (l + SIR e ) > R e , where SIR e denotes the SIR at e given 
by 



SIR P 









Sle 




—a 



(9) 



where S e and \X e \ axe the channel fading gain and the distance between the typical transmitter 
and eavesdropper e in $ e , respectively, Si e and \Xi e \ are the channel fading gain and the distance 
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between node I in and eavesdropper e in $ e , respectively. The fading gains are modeled as i.i.d. 
exponential random variables with unit mean. 

Define a threshold SIR value for secrecy outage as 



2 Re - 1. 



(10) 



Let A = {y e <3> e : SIR y > f3 e }, i.e., the set of eavesdroppers that can cause secrecy outage. Hence, 
we can define the following indicator function: l^e), which equals 1 when the eavesdropper e is in 
the set A. The secrecy outage probability equals the probability that at least one of the eavesdroppers 
in <3> e causes a secrecy outage, which can be written as 



-E $i {E $e {E s { J] (l-l A (e))}}}, 



ee<I> e 



1 - E^l E$ e 



n(i-p( 





x e 


—a 




Sle 




—a 



(11) 



where the independence in the fading gains among different eavesdroppers is used to move the 
expectation over S = {S e ,Si e } inside the product over $ e in (11). Since it is difficult to express 
P so in a closed form, we look for analytical bounds on the secrecy outage probability. The results 
are summarized in the following lemma: 

Lemma 1: The secrecy outage probability is bounded from above by 



)UB 



1 — exp 



A, 



(12) 



and bounded from below by 



>LB 



i + 



(13) 



/a r(i-i)r(i + |)' 

Proof: Using the generating functional of the PPP $ e [25], we can express the secrecy outage 
probability in (11) as 



1 — E$ ( < exp 



P 



S e \X e 


—a 




Sle 




—a 



> Pe 



$! )de 



(14) 



Jensen's inequality gives an upper bound on P s 



< 1 — exp 
= 1 — exp 



- 2ttA, 



P 



Se 




— a 




Sle 


Xl e 


—a 



->/3 e )de 



exp 



_^/«r(i-l)r( 1 + l) 



TedTe 



(15) 
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where r e denotes the distance between the typical transmitter and eavesdropper e, (15) is arrived in 
the same way as (7) followed by changing to polar coordinates. The upper bound in (12) is then 
obtained by directly evaluating the integration in (15). 

The lower bound on P so is obtained by considering only the eavesdropper nearest to the typical 
transmitter. Denote the eavesdropper (location) in <3> e that is nearest to the typical transmitter as e' 
and denote the distance between e' and the typical transmitter as r e >. The probability distribution of 
r e i is given by [28] 

/(rv) = 2A e 7rr e / exp(-A e 7rrg,). (16) 

The secrecy outage probability is bounded from below by the probability that the nearest eaves- 
dropper causes a secrecy outage, i.e., 



Pso > / 1 e ! Y — >f3 e )f(r e ,)dr e , 



2A e 7rr e /exp(-A e 7rrg,)dr e /. (17) 



The lower bound in (13) is then obtained by directly evaluating the integration in (17). ■ 
Note that the authors in [29] used the same bounding techniques to derive analytical bounds on 
the probability of connectivity in a different network scenario and numerically studied the accuracy 
of the derived bounds. From the numerical illustration in [29, Fig. 5], we know that the upper bound 
P^, B in (12) gives accurate approximation of the exact secrecy outage probability over the entire 
range of P so e [0, 1], while the lower bound P^ Q B in (13) is usually very different from the exact 
value of P so . Moreover, both P^ B and P LB are asymptotically tight in the low probability regime. 
To see this, we consider P™ « and P^ B 0, in which case the bounds in (12) and (13) can be 
approximated by 

A^ 2/Q r(i-f)r(i + f) 

Hence, both P^ B and P^f approach the exact value of P so in the low probability regime. 

Recall that the goal here is to determine the value of R e from the secrecy outage constraint of 
P so = e. Using the upper bound on the secrecy outage probability in (12), the value of R e that 
guarantees the required security level can be found as 

*=^H^( i -i) r ( i+ l) h T^r)- 

It is clear that a lower secrecy outage probability (i.e., a higher security level) requires a higher R e . 
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Having R t in (8) and R e in (19), a lower bound on the secrecy transmission capacity is obtained 
as r LB (r) = (R t — i? e )(l — o)\i. Its expression is presented in the following theorem: 

Theorem 1: A lower bound on the secrecy transmission capacity with a connection outage con- 
straint of a and a secrecy outage constraint of e is given by 



( 



r LB (r) = (l-<7)A,log 2 



1 + 



In - 



Wr(i-^)r(i+^) 



1 + 



-r i 



r l 



2 Mn^- 

1 — c 



\ 
/ 



(20) 



From our discussion on the accuracy of P^ B , we know that the lower bound on the secrecy 
transmission capacity in (20) is generally accurate for any values of a and e, and is asymptotically 
tight as e — > 0. Therefore, we will for simplicity refer to r LB (r) in (20) as the secrecy transmission 
capacity in the rest of this paper. It is clear from (20) that r LB (r) reduces as e decreases. The 
reduction in r LB (r) as e decreases can be viewed as the throughput cost of improving physical layer 
security. 

In practical network design, the connection outage constraint and the spatial transmission intensity 3 
may be under the control of the system designer. The derived closed-form characterization of the 
secrecy transmission capacity allows the designer to optimize these system parameters to maximize 
the throughput of secure transmissions with a target security level. 



A. Existence of Positive Secrecy Transmission Capacity 

A fundamental question to ask is the condition under which positive secrecy transmission capacity 
exists. From the expression in (20), one can find this condition by solving r LB (r) > 0. 
Corollary 1: The condition for positive secrecy transmission capacity is given by 

ln^^ln^— > 7rr 2 A e . (21) 
1 — a 1 — e 

In other words, positive secrecy transmission capacity is achieved if the average number of eaves- 
droppers within a distance r from the transmitter (i.e., having shorter distances than the intended 
receiver) is less than In ^— In 

Remark 1: The condition in (21) clearly gives a trade-off between the QoS and the security level 
of a network: The QoS needs to be compromised (i.e., allowing a larger value of a) in order to 



3 In networks employing an Aloha protocol, the spatial transmission intensity equals the density of potential transmitters multiplied 
by the probability of transmission. In this case, the system designer may control the probability of transmission to vary the spatial 
transmission intensity. 
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achieve a higher security level (i.e., a smaller value of e). Therefore, a moderate connection outage 
probability is usually desirable for highly secure networks. Furthermore, the feasible range of a can 
be found from (21) as 



crell — exp 



7rr 2 A e 



(22) 



Remark 2: The condition in (21) does not depend on the spatial transmission intensity A;. That is 
to say, positive secrecy transmission capacity cannot be achieved simply by bringing in additional 
legitimate users or deactivating existing legitimate users, if the connection outage and secrecy outage 
performances of the network do not meet the condition in (21). Once this condition is met and the 
network is operating with some positive secrecy transmission capacity, there exists an optimal value 
of Xi which can be found numerically using (20). To obtain some analytical insights into the optimal 
A;, we consider the low secrecy transmission capacity regime by letting In In ^ ps 7rr 2 A e which 
implies r LB (r) ps 0. We rewrite (20) as 



.LB, 



r) 



a)\ l \og 2 



1 + 



In 



A i7 rr2r(l-^)r(l+|) J 



r i + 



V 



1 + 



V 

Ae 



In 2 



In - 



A i7 rr2r(l-|)r(l+^) 
1 + 



r(i-i)r(i + £)]n£]" 
r(i-i)r(i + i)in£ 



a 



In 2 



In 



l-a 



Ar + [r(i-l)r(i + l)^]-V 



(23) 



Assuming r LB (r) in (23) is positive, the optimal value of A; that maximizes r LB (r) is given by 



j^opt _ / 2 \ a Ae 



(24) 



From (24), we see that the optimal spatial transmission intensity increases as the required security 
level increases (i.e., as e decreases). In addition, the optimal spatial transmission intensity is usually 
much higher than the density of eavesdroppers for highly secure networks. For example, A° pt /A e ~ 
63 for e = 0.01 and a — 4. Although these observations are made in the regime of arbitrarily low 
secrecy transmission capacity, as we will see in Section V, they are also valid for more general 
scenarios. 
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B. Optimal Connection Outage Probability in Sparse Networks 

When the system designer has control over the connection outage constraint, the expression of 
secrecy transmission capacity in (20) can be used to numerically find the value of a that maximizes 
r LB (r). jj ere we present a closed-form solution of the optimal connection outage probability in 
sparse networks, i.e., Xinr 2 <C 1. Note that our analysis is based on the assumption of interference- 
limited networks, which is valid if the transmit power of the legitimate users is sufficiently high 
such that the receiver noise is much weaker than the aggregate interference. 

From the discussion in Subsection III-A, we know that the value of a should not be chosen very 
close to 0. When the network is sparse, i.e., Xiirr 2 <C I, the secrecy transmission capacity in (20) 
can be approximated as 



T 



LB, 



r) « (l-<7)Ajlog 2 
= (1 -tr) Ajlog 2 







[ ln T^ 1 


ot 
2 








[wr(i-^)r(i+^)_ 






V 1 + 


A; p 


(i-|)r(i + |) 




a 
2 







/tin 


L 1 — C- 





(25) 
(26) 



where we have assumed in (25) that the path loss exponent a is not close to 2 (which happens in 
most outdoor scenarios) and the connection outage probability is not close to 0, and 



1 + 



;r(i-f)r(i + i)m^ 



K = 



r i 



(27) 



A ; 7rr 2 r|l - 2 

The optimal connection outage probability that maximizes the secrecy transmission capacity in 
(26) is given by 

1 



a opt = 1 





i 


exp 


WoW_ 



(28) 



where W (-) is the real-valued principal branch of Lambert's W function. This result is obtained 
by directly taking the derivative of r LB (r) in (26) w.r.t. a and solving for the root. Furthermore, 
one can show that the optimal connection outage probability increases when a higher security level 
(i.e., a lower e) is required. 



IV. Secrecy Guard Zone 

In this section, we consider simple protocols for improving the secrecy transmission capacity. 
We assume that the legitimate transmitters are able to detect the existence of eavesdroppers within 



13 



a finite range. We model this range as a disk with radius D centered at each transmitter and call 
it the secrecy guard zone. Transmission of confidential messages only happens when there is no 
eavesdropper inside the secrecy guard zone. As we are concerned with decentralized networks, it is 
assumed that each transmitter individually decides whether or not to transmit based on the existence 
of eavesdroppers inside its own guard zone. 

The general idea of guard zone is not new and has been applied in wireless ad hoc networks 
without or with security considerations: In [30], the authors used a guard zone around each receiver 
such that the receiver is active when there is no interferers inside the guard zone. The authors in [11] 
and [16] studied the secure connectivity and secrecy capacity scaling law of ad hoc networks in the 
presence of eavesdroppers, respectively, and applied a secrecy guard zone around each legitimate 
node. In this work, we apply a secrecy guard zone around each legitimate transmitter and consider 
the following two transmission protocols: 

1) Non- Cooperative Transmitters: The transmitter remains silent when eavesdropper(s) are 
found inside its secrecy guard zone. 

2) Cooperative Transmitters: The transmitter produces artificial noise when eavesdropper(s) are 
found inside its secrecy guard zone. 

The idea of using artificial noise for secrecy was first proposed for multi-antenna transmissions 
in [31], which is also related to the idea of cooperative jamming studied in [6,9,18,32,33]. An 
example of a network snapshot with secrecy guard zones is shown in Fig. 2. In the following, we 
study the secrecy transmission capacity with each transmission protocol. 

A. Secrecy Guard Zone with Non-Cooperative Transmitters 

The set of actual transmitter locations, denoted as has density of 

A{ = A,exp[-7rA eJ D 2 ], (29) 

where the exponential term in (29) is the probability of no eavesdropper located inside the secrecy 
guard zone of an arbitrary transmitter. With the secrecy guard zone, the distribution of the actual 
transmitters does not still follow a homogeneous PPP. The non-homogeneous nature resulted from the 
introduction of guard zone was discussed in [30]. In particular, the authors in [30] applied standard 
Poisson tests to show that the distribution of the actual transmitters can still be well- approximated 
by a homogeneous PPP outside B(b, D) from the viewpoint of a receiver at location b, where the 
notation B(b, D) stands for a disk of radius D centered at b. Based on this result, we apply the 
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following two approximations: From the viewpoint of eavesdropper e, the actual transmitter <Ev 
follows a homogeneous PPP with density A^ outside B(e,D). From the viewpoint of any legitimate 
receiver, the actual transmitter <Jty follows a homogeneous PPP with density A^. 4 
For the typical receiver, the connection outage 5 probability is given by 

P co = 1-exp -A' / 7rr 2 A 2/a r(l-^)r(l + ^) . (30) 

With the connection outage constraint P co = a and f3 t — 2 Rt — 1, the transmission rate R t is found 
as 



Rt = log 2 1 + 



1 — u 



(31) 



.A^r(i-|)r(i + f). 

From the viewpoint of the typical transmitter located at the origin o, the eavesdroppers $ e follows 
a homogeneous PPP with density A e outside B(o,D). Similar to the proof of Lemma 1, an upper 
bound on the secrecy outage probability is obtained by using the generating functional of $ e and 
applying Jensen's inequality as 
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(32) 



where Z = Y^ie®^ ^e|^e| _a is the sum of interference power at eavesdropper e and Cz(-) denotes 
the Laplace transform of Z. Note that we have assumed that $// is a homogeneous PPP outside 
B(e,D) from the viewpoint of eavesdropper e. Hence, C z { ) is given by [26] 



C z {x) 



exp 



{ ^ D 2 E 5 {l - cxp[-xSD- a ]} - x 2 / a E s {s 2/a }r(l - 

+x 2/a E s {s 2/a r(i - ^-,xSD- a ^ 



(33) 



4 Note that the second approximation usually underestimates the interference power at the typical receiver, since the potential 
interferers near the typical (active) transmitter is more likely to be active than the ones far away from the typical transmitter. 
However, this underestimation is marginal as long as \[ is reasonably close to A;, such as the scenarios to be considered in Fig. 5. 

5 The connection outage event is defined as the transmitted message being undecodable at the intended receiver. Hence, it does 
not include the event of no transmission due to the existence of eavesdropper(s) inside the guard zone. A similar note applies to the 
secrecy outage event. The effect of transmission probability on the secrecy transmission capacity is incorporated in Aj. 
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where S is an exponentially distributed random variable with unit mean and •) is the upper 
incomplete Gamma function. Using integral identities from [34] to evaluate the expectations in (33), 
we have 

xD 2 ~ a o/„,_/. 2\_/, 2- 



Cz(x) 



cxp 



-4 n -^rfi + ^rfi-^ 

'I l+a;D- a V a) \ a) 



xD 



2-a 



2 + 



a 1 + a;-D~ 



(34) 



(l-i)(l + 

where 2Fi(-) is the Gauss hypergeometric function. 

Substituting (34) into (32), P^ B is expressed in an integral form, hence, R e can be solved 
numerically with the secrecy outage constraint P^ B = e and (3 e = 2 Re — 1. A lower bound on 
the secrecy transmission capacity is found as 

r LB (r) = (R t -R e )(l-a)\' l . (35) 

B. Secrecy Guard Zone with Cooperative Transmitters 

In this scenario, the legitimate transmitters cooperative with each other. When eavesdropper(s) 
are found inside the secrecy guard zone, the transmitter produces artificial noise to help masking 
the confidential message transmissions from others. The artificial noise is assumed to be statistically 
identical to the confidential messages and hence, it cannot be distinguished from message trans- 
missions by the eavesdroppers. It is noted that this cooperative protocol is entirely distributive as it 
does not require any coordination between the legitimate transmitters. 

For any legitimate receiver or eavesdropper, the set of interferers is still with density A;. On 
the other hand, the set of actual transmitters is $// with density A^ given by 

A; = A;exp[-7rA e D 2 ]. (36) 

Since the interferers remain the same as if no secrecy guard zone is applied, the connection outage 
probability P co and the transmission rate R t are still given by (7) and (8), respectively. 

From the viewpoint of the typical transmitter located at the origin o, the eavesdroppers $ e follows 
a homogeneous PPP with density A e outside B(o, D). Again, an upper bound on the secrecy outage 
probability is found using the generating functional of $ e and applying Jensen's inequality as 
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(37) 
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With the secrecy outage constraint of P s u = e, we find R e as 

/ r / .r .n-l 



i? e = log 2 



1 + 



V 



ln^ 

1— e 



VOT(i-|)r(i + |) 



(38) 
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Theorem 2: A lower bound on the secrecy transmission capacity for networks having cooperative 
transmitters with secrecy guard zones is given by 



r LB (r) = {R t - R e ){\ - a)^ 



(1 - a)Xi exp[-7rA e D 2 ] log 2 



1 + 
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W (A e 7rD2[ln T i I ]-l) 
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(39) 



From the closed-form expression of r LB (r) in (39), we can derive the condition for positive 
secrecy transmission capacity by solving r LB (r) > 0. 

Corollary 2: The condition for positive secrecy transmission capacity is given by 
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(40) 



1 -a 1 -e 

When the system designer has control over the connection outage constraint and the guard zone 
size, positive secrecy transmission capacity can be achieved by carefully choosing the values of a 
and/or D to meet the condition in (40). Similar to the networks without guard zones, the density of 
the legitimate transmitters has no say for the existence of positive secrecy transmission capacity for 
fixed connection outage probability and guard zone size. Comparing (21) with (40), we see that the 
improvement from having the secrecy guard zone is given by the factor of [yz^ 1 ^ 2 . For a fixed 
r, the minimum required value of D increases as a or e decreases (below certain threshold value). 
Hence, one may also expect that the optimal value of D, which maximizes the secrecy transmission 
capacity in (39), increases as a or e decreases. 

To further improve the network throughput, the secrecy guard zone could in the future be used in 
combination with other types of guard zone, such as carrier sense multiple access (CSMA) at the 
transmitters [35] and the interference guard zone at the receivers [30]. 



V. Numerical Results and Discussion 

In this section, we present numerical results on the secrecy transmission capacity. We first show 
the interplay of different system parameters and their effects on the secrecy transmission capacity 
for networks without secrecy guard zones. Fig. 3 shows the secrecy transmission capacity r LB (r) 
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in (20) versus the spatial transmission intensity A; with different security requirements. Comparing 
between the four curves, we see that the gap in r LB (r) between e = 1 and e = 0.05 is relatively small 
over a wide range of A;. This suggests that the throughput cost of achieving a moderate security 
requirement is relatively low. On the other hand, r LB (r) drops dramatically as e decreases towards 
0. For example, there is a 84% reduction in r LB (r) for improving the security level from e = 0.02 
to e = 0.01 at A; = 0.01. This reflects a significant increase in the throughput cost of achieving 
highly secure networks. 

For each curve in Fig. 3, we see that the optimal value of A; is generally much larger than A e . 
This suggests that it is desirable to have a significantly larger number of legitimate nodes than 
the number of eavesdroppers in the network, which creates a high level of interference to mask 
the confidential message transmissions against eavesdropping. Furthermore, the optimal value of A; 
increases as e decreases. For example, the optimal A^ is 0.04 for e = 0.05, while it increases to 
0.051 for e = 0.02 and to 0.068 for e = 0.01. Note that the optimal value of A; computed from (24) 
is 0.063 for e = 0.01, which is very close to the numerical result. 

Fig. 4 shows the secrecy transmission capacity r LB (r) in (20) versus the connection outage proba- 
bility a with different security requirements. The feasible range of a for positive secrecy transmission 
capacity never reaches 0, which agrees with the result in (22). We see that a moderate connection 
outage probability is desirable for achieving high secrecy transmission capacity. Furthermore, the 
optimal value of a increases as e reduces. This is because that a larger R e is needed for a stronger 
security requirement, in which case larger R t and (hence) a are desirable for maximizing the secrecy 
transmission capacity. For example, the optimal a is 0.4 for e = 0.05 while it increases to 0.5 for 
e = 0.02 and to 0.6 for e = 0.01. Note that the optimal value of a can be accurately computed from 
the closed-form expression in (28) for sparse networks. 

Now, we present the results on the use of a guard zone for improving the secrecy transmission 
capacity. Fig. 5 shows r LB (r) in (35) and (39) versus the secrecy outage probability e for both the 
non-cooperative and cooperative protocols. 6 This figure clearly shows the remarkable benefit of guard 
zone for networks with high security requirements. For example, the secrecy transmission capacity at 
e = 0.01 increases from 0.003 at D = (i.e., no guard zone) to 0.018 with non-cooperative protocol 
and 0.021 with cooperative protocol at D = 3. On the other hand, the benefit of guard zone reduces 

6 Although we have chosen r = 1 in Fig. 5, the benefit of using a secrecy guard zone demonstrated in Fig. 5 is also observed for 
other values of r which can be either less than or greater than D (plots omitted for brevity). 
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as the security requirement reduces. We also see that the cooperative protocol outperforms the non- 
cooperative protocol and the difference in secrecy transmission capacity is significant for networks 
with high security requirement. For example, the increase in r LB (r) from the non-cooperative case 
to the cooperative case at e = 0.01 is 17% when D = 3 and 14% when D — 6. 

The feasible regions of the connection outage probability a and the secrecy outage probability e for 
positive secrecy transmission capacity are illustrated in Fig. 6. The case of cooperative transmitters 
is considered when the guard zone is used. In general, it is impossible to have arbitrarily low outage 
probabilities while still operating at some positive secrecy transmission capacity. Nevertheless, the 
use of a guard zone greatly enlarges the feasible ranges of both outage probabilities. 

Fig. 7 shows the optimal guard zone radius for cooperative transmitters. We see that the optimal 
value of D reduces as the acceptable secrecy outage probability e increases and it reaches zero at 
moderate to high values of e. We can also see the dependence of the optimal D on a and A;. The 
general trend is that the optimal D reduces as a or A; increases. The dependence of the optimal 
D on a agrees with our earlier observation from (40). The dependence on A; can be understood as 
follows: As the interference level (i.e., A^) increases, the signal power received at the eavesdroppers 
is allowed to be higher for maintaining the same SIR. This in turn allows us to reduce the guard 
zone radius, which increases the spatial intensity of message transmissions. In practice, a legitimate 
transmitter may only be able to detect the existence of eavesdroppers in its vicinity, hence, the 
guard zone is usually small. Nevertheless, we have seen from Fig. 5 that a significant improvement 
in the secrecy transmission capacity can be achieved even with a small guard zone. Furthermore, 
by allowing a moderate connection outage probability, it is possible for the network to operate with 
the optimal guard zone radius which is within the maximum detection range of the transmitters. 

VI. Conclusions 

In this work, we defined a performance metric named the secrecy transmission capacity, which 
was used to study the impact of physical layer security requirements on the throughput of large- 
scale decentralized wireless networks. Using tools and existing results from stochastic geometry, 
the secrecy transmission capacity can usually be characterized in simple analytical forms, as shown 
in this paper for Rayleigh fading channels. One important finding is that the throughput cost of 
achieving a moderate security level is relatively low, while it becomes very expensive to realize 
a highly secure network. In addition, we showed that the application of secrecy guard zone with 
artificial noise is a simple technique that can be used to dramatically reduce the throughput cost of 
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achieving highly secure networks. 

This model of secrecy transmission capacity can be extended to analyze and design networks 
with other transmission techniques, medium access control protocols, and eavesdropping strategies 
in future work. Similar to other transmission capacity formulations, the main limitation of this model 
is that it only considers single-hop transmissions, while the communication between an arbitrary 
source-destination pair usually requires multiple hops. End-to-end throughput analysis of wireless 
networks with physical layer security requirements is still an open problem. Another limitation of 
the current model is the homogeneous Poisson distribution of nodes. The impact of eavesdropper 
distribution on secrecy throughput is an interesting problem to investigate. 
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TABLE I 
List of Notation 





Poisson point process (PPP) of legitimate transmitter locations 


$ e 


PPP of eavesdropper locations 


A, 


Density of $ ; 


A e 


Density of $ e 


Rt 


Rate of the transmitted codewords 


Rs 


Rate of the confidential messages 


Re 


Rt — R s , rate loss for securing the messages against eavesdropping 


p 

A CO 


Connection outage probability 


Pso 


Secrecy outage probability 


a 


Constraint on P co 


e 


Constraint on P so 


r(r) 


Secrecy transmission capacity with transmission distance r 


ft 


Threshold signal to interference ratio (SIR) for connection outage 


ft 


Threshold SIR for secrecy outage 


S 


Rayleigh fading gain of the wireless channel 


D 


Radius of secrecy guard zones 


P(.) 


Probability operator 


E{.} 


Expectation operator 
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Fig. 1. An example of a part of a network snapshot. Each legitimate transmitter, Ti,i = 0,1,2,3, has an intended receiver 
Ki,i — 0, 1,2,3, located at a distance r. In addition, there are eavesdroppers, Ej,i = 1,2, presented in the network. Consider the 
confidential message transmission from To. The intended receiver Ro as well as each eavesdropper Ei, i = 1, 2 all try to individually 
decode the transmitted message. The signal reception at Ro and (an arbitrary eavesdropper) Ei are shown in figures (a) and (b), 
respectively. In both cases, the concurrent transmissions from Ti, T2 and T3 act as interference. 
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Fig. 2. An example of a part of a network snapshot with a secrecy guard zone around each transmitter. Transmitters To, Ti, 
and T2 do not find any eavesdropper inside their individual guard zone, and hence, transmit confidential messages to their intended 
receivers. However, transmitter T3 detects an eavesdropper, E2, insides its guard zone. If the non-cooperative protocol is used, T3 
remains silent. If the cooperative protocol is used, T3 transmits artificial noise. 




Fig. 3. The secrecy transmission capacity r LB (r) in (20) versus the density of legitimate transmitters A;. Results are shown for 
networks with different secrecy outage constraints, i.e., e = 0.01,0.02,0.05, as well as no secrecy constraint, i.e.,e = 1. The other 
system parameters are r = 1, a = 4, a = 0.3, and A e = 0.001. 
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Fig. 4. The secrecy transmission capacity r LB (r) in (20) versus the connection outage probability a. Results are shown for networks 
with different secrecy outage constraints, i.e., e = 0.01,0.02,0.05, as well as no secrecy constraint, i.e.,e = 1. The other system 
parameters are r = 1, a = 4, Aj = 0.01, and A e = 0.001. 
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Fig. 5. The secrecy transmission capacity r LB (r) with guard zone in (35) and (39) versus the secrecy outage probability e. Results 
are shown for networks with different guard zone radii, i.e., D = 0, 3, 6. The other system parameters are r = 1, a = 4, a = 0.3, 
A ; = 0.01, and A c = 0.001. 
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Fig. 6. The region of positive secrecy transmission capacity with and without secrecy guard zone. The case of cooperative transmitters 
is shown with different guard zone radii, i.e., D — 0,3, 6. The curves are plotted based on the relationship between the connection 
outage probability a and the secrecy outage probability e given in (40). The other system parameters are r = 1 and A e = 0.001. 
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Fig. 7. The optimal secrecy guard zone radius versus the secrecy outage probability e for the case of cooperative transmitters. 
Results are shown for networks with different connection outage constraints, i.e.,<r = 0.1,0.3, and different densities of legitimate 
transmitters, i.e., A; = 0.01, 0.05. The other system parameters are r = 1, a = 4, and A e = 0.001. 



